CVE-2026-108097

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 10.6.19 Drupal versions prior to 11.3.19 Drupal versions prior to 11.4.10

Description A remote code execution issue exists within the Field UI module (field ui) in Drupal core. While the issue is not directly exploitable using core functionality alone, multiple serious exploit paths are available through the use of contributed modules or custom code. At least one known exploit path allows for unauthenticated remote code execution. Approximately 151,000 sites are potentially affected due to the use of outdated CMS branches. This flaw can be used to achieve lateral movement from compromised web servers into internal infrastructure.

Recommendations Update to version 10.6.19. Update to version 11.3.19. Update to version 11.4.10. As a temporary mitigation, uninstall the field ui module to restrict field management via the administrative panel and block known attack vectors.